Framework Watch: ADK Python 2.14 Takes the Shell String Away From Skill Scripts

Two releases this cycle change what an agent is allowed to do by default. Both are worth reading for their behaviour changes rather than their feature lists.

ADK Python 2.14.0

The tag was published on November 7, 2026 UTC, although its changelog is headed November 4. The notes say execution environments, A2A, evaluation and core runtime modules graduate from experimental.

Skill scripts lose the shell string. With a SkillToolset environment, RunSkillScriptTool no longer takes command. The model passes args, short_options and positional_args, and the script runs from validated paths. This is a breaking change and also a real reduction in injection surface, because a model can no longer compose an arbitrary command line through this tool.
Stable environments. BaseEnvironment, LocalEnvironment, EnvironmentToolset, DaytonaEnvironment and E2BEnvironment are now stable, and ReadFileTool streams line ranges instead of loading whole files.
Evaluation. adk eval --num_runs repeats each case and combines scores, which is the honest way to score a nondeterministic agent. ToolArgsMatcher can compare arguments exactly, case-insensitively, with numeric tolerance or semantically.
Performance. The notes report a 30-node workflow's 200-turn run as 23 percent faster with 9 percent lower peak memory.

Three upgrade traps stand out. Enum tool arguments now arrive as enum members rather than raw strings. Token-threshold compaction counts tool outputs since the last model call, "so it fires earlier for an unchanged token_threshold". And FirestoreSessionService changes its storage so that sessions this version writes cannot be read by 2.13.0 or earlier after a rollback, which makes a downgrade harder than it looks.

Claude Code 2.1.319

Released November 6, this version adds permissions.denyInsteadOfPrompting, so that a tool call that would wait on a permission prompt is denied and the turn continues, including for subagents. That suits unattended runs where nobody is present to answer. It also moves MCP tasks to the background when a server runs a tool call as a task.

Two fixes matter for anyone relying on policy. One covers "a case where Bash deny and ask rules missed commands written with quoted words". Another changes claude -p, which used to exit 0 in auto mode when actions were refused because no safety check was available, and now exits 1. A pipeline that treated exit 0 as success could have been reporting work that never ran.

What remains uncertain. The ADK performance figure is the maintainers' single benchmark, and we have not run either release. Release notes describe intent, and the actual coverage of the quoted-word fix is visible only in the shipped behaviour.

Analysis: Read upgrades for changed defaults. If Jenya's returns workflow at Belgavi's Book Store has a compaction threshold tuned on 2.13, expect summaries to appear sooner after the upgrade and re-check any test that depended on the old timing. For deny rules, add a test that a quoted form of a forbidden command is refused, rather than trusting the rule as written.

Sources and evidence

ADK Python 2.14.0 replaces free-form shell commands to skill scripts with structured arguments, makes environments and A2A stable, and adds multi-run evaluation, but changes Enum arguments, compaction timing and Firestore rollback compatibility. Claude Code 2.1.319 adds denyInsteadOfPrompting, fixes deny rules that missed quoted words, and makes refused headless runs exit 1.